Section 38: Records retention and protection of data (As amended by section 9 of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2024)

1 A service provider shall keep and protect specific traffic data and subscriber information in accordance with the provision of the Nigeria Data Protection Act and as may be prescribed by the relevant authority for the time being, responsible for the regulation of communication services in Nigeria, for a period of two years communication services in Nigeria, for a period of 2 years.

2 A service provider shall, at the request of the relevant authority referred to in subsection (1) of this section or any law enforcement agency-
a preserve, hold or retain any traffic data, subscriber information, non-content information, and content data; or
b release any information required to be kept under subsection (1) of this section.

3 A law enforcement agency may, through its authorised officer, request for the release of any information in respect of subsection (2)(b) of this section and it shall be the duty of the service provider to comply.

4 A data retained, processed or retrieved by the service provider at the request of any law enforcement agency under this Act shall not be utilized except for legitimate purposes as may be provided for under this Act, any other legislation, regulation or by an order of a court of competent jurisdiction.

5 A person exercising any function under this section shall have due regard to the individual's right to privacy under the Constitution of the Federal Republic of Nigeria, 1999 and shall take appropriate measures to safeguard the confidentiality of the data retained, processed or retrieved for the purpose of law enforcement.

6 Subject to the provisions of this Act, any person who contravenes any of the provisions of this section commits an offence and is liable on conviction to imprisonment for a term of not more than 3 years or a fine of not more than =N 7,000,000.00 or both.